CVE Catalog
CVE-2026-73383
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk0.35%
28th percentile - higher than 28% of all known CVEs
Summary
The CTX Feed plugin version 6.6.47 and earlier has an arbitrary file download vulnerability exploitable by users with the Shop manager role. This means a shop manager can download arbitrary files from the server that they should not have access to.
Risk Assessment
The risk is that a user with shop manager privileges can download sensitive files, such as configuration files or data, potentially leading to confidentiality breaches.
Recommendation
It is recommended to update the plugin to the latest version that includes a fix for this vulnerability.
Original NVD description (English source)
Shop manager Arbitrary File Download in CTX Feed <= 6.6.47 versions.